Content provider system

ABSTRACT

Even if contents data distributed over a network are once destroyed, the contents data are restored, as the copyright protection is maintained. A PC memorizes backup of distributed music contents on a hard disc, at the same time as it transmits the using log information of the music contents stored in the hard disc to an EMD server. If the music contents in the hard disc are destroyed, the PC acquires the using log information from the EMD server to reproduce the backup data memorized in the hard disc depending on the using log information.

TECHNICAL FIELD

This invention relates to a contents furnishing system for furnishingcontents data, such as music data, over a network, a contentsdistribution system and to a recording medium.

BACKGROUND ART

Recently, on-line distribution of music contents employing a network,such as Internet or cable television, has come to be put to practicalapplication.

If, in this distribution system for music contents, the contentsdistributors distribute the musical contents over the network, on e.g.,the Web, The user exploiting this music distribution system uses his orher own personal computer to access the Web furnished by the contentsdistributor to download the desired music contents.

Meanwhile, in this music distribution system, the downloaded musiccontents are made payable over e.g., a network.

However, if once the data in a personal computer owned by a user isdestroyed, the music contents, once purchased, are lost. So, forrestoring the music contents, the contents need to be purchased again.

DISCLOSURE OF THE INVENTION

It is therefore an object of the present invention to provide a contentsfurnishing system in which, even if the contents, distributed over anetwork, are destroyed, the contents data can be restored as thecopyright protection is assured.

It is another object of the present invention to provide a contentsdistribution system in which, even if the contents, distributed over anetwork, are destroyed, the contents data can be restored as thecopyright protection is assured.

It is a further object of the present invention to provide a recordingmedium having stored therein a playback control program, which iscapable of restoring contents data even if the contents data,distributed over a network, are destroyed, as the copyright protectionis assured.

In one aspect, the present invention provides a contents furnishingsystem including a contents server for distributing contents data over anetwork, and a data processor having a reproduction control program forreproducing and/or controlling contents data, in which the dataprocessor stores the contents data distributed from the contents serveron a recording medium for reproduction and/or control, and stores backupdata of the distributed contents data on a recording medium, the dataprocessor also transmitting the using log information of the contentsdata to the contents server. The data processor acquires the using loginformation from the contents server if the contents data cease to beavailable from the recording medium, while performing reproductionand/or control of the backup data of the contents data stored in therecording medium depending on the using log information.

In this contents furnishing system, the data processor reproduces and/orcontrols backup restoration data based on the using log informationre-acquired from the contents server.

In another aspect, the present invention provides a contents furnishingsystem including a contents server for distributing contents data over anetwork, and a data processor having a reproduction control program forreproducing and/or controlling contents data, in which the dataprocessor stores the contents data distributed from the contents serveron a recording medium for reproduction and/or control, and transmits theusing log information of the contents data to the contents server. Thedata processor has contents data re-distributed from the contentsserver, if the contents data cease to be available from the recordingmedium. The data processor also acquires the using log information fromthe contents server while performing reproduction and/or control of there-distributed contents data depending on the using log information.

In this contents furnishing system, the data processor reproduces and/orcontrols re-distributed contents data based on the using log informationre-acquired from the contents server.

In still another aspect, the present invention provides a method fordistributing contents between a data processor having a reproductioncontrol program for reproducing and/or controlling contents data and acontents server for distributing the contents data through a network tothe data processor, in which the method includes the steps of thecontents server distributing contents data to the data processor, thedata processor memorizing the contents data distributed from thecontents server in a recording medium for reproduction and/or controland also memorizing backup data of the distributed contents data in arecording medium, the data processor transmitting the using loginformation of the contents data to the contents server, the contentsserver transmitting the using log information to the data processor ifthe data processor is unable to acquire the contents data from therecording medium, and the data processor reproducing and/or controllingthe backup data of the contents data stored in the recording mediumresponsive to the using log information.

In this contents distributing method, the data processor reproducesand/or controls backup restoration data based on the using loginformation re-acquired from the contents server.

In still another aspect, the present invention provides a method fordistributing contents between a data processor having a reproductioncontrol program for reproducing and/or controlling contents data and acontents server for distributing the contents data through a network tothe data processor, in which the method includes the steps of thecontents server distributing contents data to the data processor, thedata processor memorizing the contents data distributed from thecontents server in a recording medium for reproduction and/or control,the data processor transmitting the using log information of thecontents data to the contents server, the contents serverre-distributing, if the data processor is unable to acquire the contentsdata from the recording medium, the contents data that has becomeunavailable to the data processor and transmitting the using loginformation to the data processor, and the data processor reproducingand/or controlling the re-distributed contents data in accordance withthe using log information.

In this contents distributing method, the data processor reproducesand/or controls re-distributed contents data based on the using loginformation re-acquired from the contents server.

In still another aspect, the present invention provides a recordingmedium adapted for being installed in a data processor and having storedtherein a reproduction control program for acquiring contents datadistributed over a network from a contents server for reproducing and/orcontrolling the contents data, in which the reproduction control programincludes memorizing the contents data distributed from the contentsserver in a recording medium for reproduction and/or control andmemorizing backup data of the distributed contents data, andtransmitting the using log information of the contents data to thecontents server and acquiring the using log information from thecontents server if the contents data cease to be available from therecording medium and reproducing and/or controlling backup data ofcontents data stored in the recording medium in keeping with the usinglog information.

In this recording medium, the reproduction control program reproducesand/or controls the restoration backup data for the data processor,having the reproduction control program installed thereon, based on theusing log information re-acquired from the contents server.

In yet another aspect, the present invention provides a recording mediumadapted for being installed in a data processor and having storedtherein a reproduction control program for acquiring contents datadistributed over a network from a contents server for reproducing and/orcontrolling the contents data, in which the reproduction control programincludes memorizing the contents data distributed from the contentsserver in a recording medium for reproduction and/or control,transmitting the using log information of the contents data to thecontents server, having contents data re-distributed from the contentsserver, if the contents data cease to be available from the recordingmedium, and acquiring the using log information from the contents serverand reproducing and/or controlling the re-distributed contents data inkeeping with the using log information.

In this recording medium, the reproduction control program reproducesand/or controls there-distributed contents data for the data processor,having the reproduction control program installed thereon, based on theusing log information re-acquired from the contents server.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a system structure of a music contents distributing systemembodying the present invention.

FIG. 2 explains the configuration of a personal computer used in thecontent data management system.

FIG. 3 explains the configuration of a portable device included in thecontent data management system.

FIG. 4 explains functions of the personal computer.

FIG. 5 shows an example of display/operation-instructive window.

FIG. 6 shows an example of the window which the recording program makesthe display unit display.

FIG. 7 explains unified handling of contents having different formatsfrom one distributor to another in the music contents distributingsystem.

FIG. 8 illustrates the relation between a unified transfer protocollayer and an application layer.

FIG. 9 illustrates the format of the routinely used using conditioninformation.

FIG. 10 illustrates a file constituting the unified using conditioninformation employed in a comprehensive management unit.

FIG. 11 illustrates the structure of an automaton file of the unifiedusing condition information.

FIG. 12 shows an example of an automaton indicating the operationtransition of music contents stated in the automaton stating portion ofthe automaton file.

FIG. 13 represents the automaton in a tuple string.

FIG. 14 illustrates the structure of the automaton stating portion.

FIG. 15 shows an event and a command defined in a DTD determined basedon the specification of an XML.

FIG. 16 shows a first statement example of the automaton statingportion.

FIG. 17 is a state transition view of the first statement example.

FIG. 18 shows a second statement example of the automaton statingportion.

FIG. 19 is a state transition view of the second statement example.

FIG. 20 shows a third statement example of the automaton statingportion.

FIG. 21 is a state transition view of the third statement example.

FIG. 22 shows a fourth statement example of the automaton statingportion.

FIG. 23 shows the structure of a parameter file of the unified usingcondition information.

FIG. 24 illustrates the structure in case the parameter file has beenchanged.

FIG. 25 illustrates the structure of a parameter statement portion ofthe parameter

FIG. 26 illustrates a method for supervising the contents by thecomprehensive management unit.

FIG. 27 illustrates the processing sequence in case the comprehensivemanagement unit is installed from a CD-ROM.

FIG. 28 illustrates the processing sequence in case the comprehensivemanagement unit is installed on being downloaded from the network.

FIG. 29 illustrates an updating sequence from a ripping key to an EMDkey.

FIG. 30 illustrates a first example of the EMD key updating sequence.

FIG. 31 illustrates a second example of the EMD key updating sequence.

BEST MODE FOR CARRYING OUT THE INVENTION

Referring to the drawings, a music contents distributing system,embodying the present invention, representing the best mode of executionof the present invention, is explained in detail. This music contentsdistribution system is such a system which downloads the music contentsfrom a server to a personal computer or to a portable device over anetwork and which supervises the so-downloaded music contents and musiccontents read out from a CD.

(1) Overall Structure of Music Contents Distributing System

FIG. 1 shows a system configuration of a music contents distributingsystem 1 embodying the present invention.

The music contents distributing system 1, embodying the presentinvention, includes a personal computer 1, a network 2, such as localarea network, a registration server 3, a plurality of EMD (electricalmusic distribution) servers 4 (4-1, 4-2 and 4-3) distributing musiccontents, referred to below as contents, and WWW servers 5 (5-1 and5-2). The personal computer 1 has stored therein a storage medium, suchas a memory card, over USB cables 7 (7-1, 7-2 and 7-3), and is connectedto portable devices 6 (6-1, 6-2, 6-3) as a portable music reproducingequipment for reproducing the contents.

The personal computer 1 is connected over a network 2 to the EMDregistration server 3, EMD servers 4 (4-1, 4-2 and 4-3) and to the WWW(World Wide Web) servers 5 (5-1 and 5-2).

The personal computer 1 receives contents compressed in accordance witha pre-set compression system, and encrypts the compressed contents inaccordance with a pre-set encryption system for storage. As thecompression system, ATRAC (adaptive transform acoustic coding) 3(trademark) or MP3 (MPEG audio layer-3) may be used. As the encryptionsystem, description (data encryption standard), for example, is used.

In receiving the distributed contents, the personal computer 1 alsoreceives distributed using condition information, indicating the usingconditions for the contents, to record the distributed data. Whenrecording the contents read out from e.g., a CD, the personal computer 1generates the using condition information depending on the contentsreproducing conditions to record the generated using conditioninformation.

Also, the personal computer 1 records and stores the contents, recordedencrypted, in the portable devices 6 (6-1, 6-2 and 6-3), over th USBcables 7 (7-1, 7-2 and 7-3), along with the relevant information, suchas the using condition information, titles of musical numbers or thenames of the performers, while updating the using condition informationresponsive to the recording and storage. This processing is calledcheckout. In this checking-out operation, the number of times ofpossible checking-out operations for the contents, recorded by thepersonal computer 1, is decremented by 1 in the using conditioninformation. If the number of times of possible checking-out operationsis 0, the corresponding contents cannot be checked out.

Moreover, the personal computer 1 erases the contents stored in theportable devices 6 (6-1, 6-2 and 6-3), through the USB cables 7 (7-1,7-2 and 7-3), and updates the using condition information in associationwith the erasure. This erasure operation is called check-in. In thischeck-in operation, the number of times of the possible checking-outoperations, recorded by the personal computer 1, is incremented by 1. Itis noted that the contents may also be made unusable instead of beingerased.

It is noted that the personal computer 1 is unable to check-in thecontents some other personal computer has checked out to the portabledevice 6. That is, the personal computer 1 is only able to check-in thecontents checked out by no other than the personal computer 1.

When the personal computer 1 has started acquiring the contents from theEMD servers 4 (4-1, 4-2 and 4-3), the EMD server 3 is responsive to arequest from the personal computer 1 to transmit an authentication keynecessary for reciprocal authentication between the personal computer 1and the EMD servers 4 (4-1, 4-2 and 4-3) to the personal computer 1,over the network 2, while transmitting the program for connection to theEMD servers 4 (4-1, 4-2 and 4-3) to the personal computer 1.

The EMD servers 4 (4-1, 4-2 and 4-3) are each responsive to a request ofthe personal computer 1 to furnish contents to the personal computer 1,over the network 2, along with the using condition information and datarelevant to the contents, such as the titles of the music numbers or theperformers.

The contents distributed by the respective EMD servers 4 (4-1, 4-2 and4-3) have been compressed in accordance with a pre-set encryption systemwhich may differ from one server to another. On the other band, thecontents furnished by the EMD servers 4 (4-1, 4-2 and 4-3) aredistributed encrypted in accordance with a pre-set encryption systemwhich may also differ from one server to another.

The WWW servers 5 (5-1, 5-2) are each responsive to the request from thepersonal computer 1 to furnish to the personal computer 1 datacorresponding to a CD which has read the contents, such as album name ofthe CD or the CD selling company) and data corresponding to the contentsread out from the CD, such as the name of the musical number or thecomposer's name, to the personal computer 1.

The portable devices 6 (6-1, 6-2 and 6-3) reproduce the contentsfurnished from the personal computer 1, that is the content as checkedout, to output the reproduced contents to e.g., a headphone, not shown.

Each of the portable devices 6 (6-1, 6-2 and 6-3) has a recording mediumfor storage of the contents. As the recording medium, a unremovable ICmemory, loaded on an internal substrate of an apparatus, or a removablememory card, is used. The portable devices 6 (6-1, 6-2 and 6-3) areconnected to the personal computer 1 over physical interfaces 7 (7-1,7-2 and 7-3), such as USB, for transferring the contents. The contents,to which is also appended the using condition information, aretransferred in the encrypted and compressed form.

The portable devices 6 (6-1, 6-2 and 6-3) are usually employed in such astate that the respective devices 6 are disconnected from the personalcomputer 1. If a replay command is issued from the user in this state,the encrypted contents are read out from the recording medium andreproduced. Moreover, the portable devices 6 (6-1, 6-2 and 6-3) managecontrol for limiting the reproduction, based on the using conditioninformation appended to the respective contents, or as necessary,deleting the contents, or updating the using condition information.

In the following, if it is unnecessary to distinguish the portabledevices 6 (6-1, 6-2 and 6-3) from one another, they are simply referredto as portable devices 6.

FIG. 2 is an explanatory illustration of the configuration of thepersonal computer 1.

As shown, the personal computer 1 comprises a CPU (central processingunit) 11. The CPU 11 actually executes a variety of applications (willfurther be described later) and OS (operating system). A ROM (read-onlymemory) 12 is also provided in the personal computer 1, and generallystores basically fixed data of programs and computational parametersused in the CPU 11. Also, a RAM (random-access memory) 13 is included inthe personal computer 1 to store programs used for execution of theapplications and OS by the CPU 11 and parameters which are appropriatelyvariable in the execution of the applications and OS. The CPU 11, ROM 12and RAM 13 are mutually connected to each other by a host bus 14composed of a CPU bus, etc.

The host bus 14 is connected to an external bus 16 such as PCI(peripheral component interconnect/interface) by a bridge 15.

A keyboard 18 is operated by the user to input various commands to theCPU 11. A mouse 19 which is used by the user to point and select a pointon the screen of a display unit 20. The display unit 20 is a liquidcrystal display or CRT (cathode-ray tube) to display a variety ofinformation in the form of a text and/or image. Further, an HDD (harddisc drive) 21 drives a hard disc to write or read a program to beexecuted by the CPU 11 and information to or from the hard disc.

The drive 22 reads data or program recorded in any of a magnetic disc41, optical disc 42 (including CD), magneto-optical disc 43 andsemiconductor memory 44, whichever is connected to the drive 22, andsupplies the read data or program to the RAM 13 connected thereto by aninterface 17, external bus 16, bridge 15 and host bus 14.

The USB port 23 (23-1, 23-2, 23-3) has the portable device 6 (6-1, 6-2,6-3) connected thereto by the USB cable 7 (7-1, 7-2, 7-3), and outputsdata (including a content or a command to the portable device 6, forexample) supplied from the HDD 21, CPU 11 or RAM 13 to the portabledevice 6 (6-1, 6-2, 6-3) via the interface 17, external bus 16, bridge15 or host bus 14.

An audio input/output interface 24 having an IEC (InternationalElectrotechnical Commission) 60958 terminal 24 interfaces a digitalaudio input/output or an analog audio input/output. A speaker 45provides a predetermined sound corresponding to each content based on anaudio signal supplied from the audio input/output interface 24.

The accessories including the keyboard 18, the mouse 19, the display 20,the HDD 21, drive 22, the USB port 23 and the audio input/outputinterface 24 are connected to the interface 17 which in turn isconnected to th CPU 11 by the external bus 16, bridge 15 and host bus14.

A communications block 25 connected to the network 2, and transmit, asstored in packets in a predetermined manner, data (e.g., request forregistration or request for sending a content) supplied from the CPU 11or HDD 21 via the network 2 while outputting data (e.g., authenticatekey or content) stored in received packets to the CPU 11, RAM 13 or HDD21 via the network 2.

The CPU 32 of an adaptor 26 formed integrally as a semiconductor IC, andconnected to the personal computer 1 is connected to the CPU 11 by theexternal bus 16, bridge 15 and host bus 14 and thus cooperates with theCPU 11 to effect various processes. The RAM 33 stores data and programsnecessary for execution of the various processes by the CPU 32. Thenonvolatile memory 34 stores data which have to be held still after thepersonal computer 1 is turned off. The ROM 36 stores a program fordecryption of an encrypted program transferred from the personalcomputer 1. The RTC (Real Time Clock) 35 keeps time to provide timeinformation. The semiconductor IC is designed to have a securedenvironment and has tolerance toward fraudulent accesses from outside.This function may be structured in a software program.

The communications block 25 and adaptor 26 are connected to the CPU 11by the external bus 16, bridge 15 and host bus 14.

Referring now to FIG. 3, the portable device 6 is schematicallyillustrated in the form of a block diagram.

A power circuit 52 converts a voltage supplied from a dry cell 51 to aninternal power of a predetermined voltage. Supplying the power tocomponents from a CPU 53 to display unit 67, the power circuit 52 willthus drive the entire portable device 6.

When connected to the personal computer 1 by a USB connector 56 and USBcable 7, the USB controller 57 will supply data including a contenttransferred from the personal computer 1 to the CPU 53 via an internalbus 58.

A data to be transferred from the personal computer 1 is composed ofdata of 64 bytes per packet, and transferred from the personal computer1 at a transfer rate of 12 Mbits/sec.

A data to be transferred to the portable device 6 is composed of aheader and content. The header stores a content ID, file name, headersize, content key, file size, codec ID, file information, etc. and alsousing condition information, etc., necessary for the playbacklimitation. The content is coded by the encoding method such as ATRAC3and encrypted.

The header size indicates a data length of a header (e.g., 33 bytes),and the file size indicates a data length of the content (e.g.,33,636,138 bytes).

The content key is a key for decryption of an encrypted content, andtransmitted from the personal computer 1 to the portable device 6 in aformat encrypted based on a session key (provisional) generated via amutual authentication between the personal computer 1 and portabledevice 6.

When the portable device 6 is connected to the USB port 23 of thepersonal computer 1 by the USB cable 7, there will be made a mutualauthentication between the portable device 6 and personal computer 1.This mutual authentication is of a challenge-response type for example.Note that a DSP (digital signal processor) 59 is also provided in theportable device 6 to decrypt an encrypted content when thechallenge-response type authentication is done.

The above-mentioned challenge-response type mutual authentication issuch that in response to a certain value (challenge) generated by thepersonal computer, for example, there is generated a value (response) bythe portable device 6 by using a private key common to both the portabledevice 6 and personal computer 1. In the challenge-response type mutualauthentication, the value generated by the personal computer 1 varies atevery authentication. So, even when for example a value generated usingthe private key and outputted from the portable device 6 is read, thatis, a so-called disguised attack takes place, the personal computer 1can detect a fraudulence since a next mutual authentication is doneusing a different value.

The content ID is an ID for a content to identify the content.

The codec ID is an ID corresponding to an encoding method for a content.For example, a codec ID of “1” corresponds to ATRAC3 while a codec ID of“0” corresponds to MP3 (MPEG (Moving Picture Experts Group) AudioLayer-3).

The file name is a data resulted from conversion of a content file (willfurther be described later) corresponding to a content and recorded inthe personal computer 1 to an ASCII (American National Standard Code forInformation Interchange) code. The file information is a data resultedfrom conversion of a music piece title (content name), name of theartist playing the music piece, name of the songwriter of the musicpiece or name of the composer of the music piece to an ASCII code.

When the portable device 6 receives a content and a content writecommand from the personal computer 1, the CPU 53 which executes a mainprogram read from a RAM 54 or ROM 55, will receive the write command,control a flash memory controller 60 and write to a flash memory 61 thecontent received from the personal computer 1.

The flash memory 61 has a storage capacity of about 64 Mbytes to storethe content. Also, the flash memory has stored therein in advance aplayback code for expansion of a content having been compressed in apredetermined manner.

Note that the flash memory 61 may be formed as a memory card which isconnectable to, and removable from, the portable device 6.

When the CPU 53 is supplied with a playback command corresponding to apush-down operation of a play/stop button (not shown) via an operationkey controller 62, it will make the flash memory controller 60 read theplayback code and content from the flash memory 61 and transfer them tothe DSP 59 of the portable device 6.

After detecting error in the content in the CRC (cyclic redundancycheck) method according to the playback code transferred from the flashmemory 61, the DSP 59 will play back the content and the played-backdata (indicated with a reference D1 in FIG. 3) to a digital/analogconversion circuit 63.

The DSP 59 is formed integrally with a transmission circuit (not shown)provided inside the portable device 6 to play back a content based on amaster clock MCLK from an external crystal oscillator 59A, and suppliesthe digital/analog conversion circuit 63 with the master clock MCLK, abit clock BCLK generated by an internal oscillation circuit based on themaster clock MCLK and having a predetermined frequency, and an operatingclock LRCLK composed of an L-channel clock LCLK and R-channel clock RCLKin the units of frames.

For playing back a content, the DSP 59 will supply the above-mentionedoperating clock to the digital/analog conversion circuit 63 according tothe playback code. When playing back no content, the DSP 59 will stopsupplying the operating clock according to the playback code to turn offthe digital/analog conversion circuit 63, thereby reducing the powerconsumption of the entire portable device 6.

Similarly, the CPU 53 and USB controller 57 have external crystaloscillators 53A and 57A connected thereto, respectively, and effectpredetermined operations on the basis of master clocks MCLK suppliedfrom the oscillators 53A and 57A, respectively.

Because of the above-mentioned construction, the portable device 6 needsno clock generation module to supply a clock to each of the CPU 53, DSP59 and USB controller 57 and thus can be designed to have a simpler andmore compact circuit construction.

The digital/analog conversion circuit 63 converts a played-back contentto an analog audio signal and supplies it to an amplification circuit64. The amplification circuit 64 amplifies the audio signal and suppliesit to headphone via a headphone jack 65.

Thus, when the play/stop button is pressed, the portable device 6 playsback a content stored in the flash memory 61 under the control of theCPU 53. When the play/stop button is pressed in the course of playingback a content, the portable device 6 will stop playing back thecontent.

When the play/stop button is pressed after stopping the content playbackoperation, the portable device 6 will resume the content playback at theposition where the playback operation has been stopped under the controlof the CPU 53. When a time of a few seconds has passed with noadditional operation effected after the playback operation is stopped bypressing the play/stop button, the portable device 6 will automaticallyshut off the power supply, thereby reducing the power consumption.

It should be noted here that when the play/stop button is pressed afterthe power supply is turned off, the portable device 6 will resume theplayback at the first music piece or music piece No. 1 without playingback the content at the position where the playback operation haspreviously been stopped.

Also, the CPU 53 of the portable device 6 makes an LCD controller 68display on a display unit 67 a playback mode (e.g., repeated play,introducing play, etc), equalization adjustment (i.e., gain adjustmentfor a frequency band of the audio signal), number for music piece,playing time, operation modes such as play, stop, fast forward and fastrewind, and information such as sound volume and voltage level in thedry cell 51.

Further, the portable device 6 stores into an EEPROM 68 a number ofcontents written in a flash memory 80, locations of blocks of the flashmemory 61 in which contents are written, respectively, and a so-calledFAT (file allocation table) for various information stored in thememory.

It should be noted that in this embodiment, a content is taken as oneblock of 64 kbytes and a location of the block for the content of eachmusic piece is stored in the FAT.

In case a FAT is stored into the flash memory 61, when the content of afirst music piece is written into the flash memory 61 under the controlof the CPU 53, the location of a block corresponding to the content ofthe first music piece will be written as FAT into the flash memory, andthen when the content of a second music piece is written into the flashmemory 61, the location of a block corresponding to the content of thesecond music piece will be written as FAT into the flash memory 61 (inthe same area as that in which the first music piece has already beenwritten).

In this way, a FAT is rewritten each time the content is written intothe flash memory 61 and further the same data will be written again forreservation to protect the data.

When FAT is written into the flash memory 61, the same area in the flashmemory will be rewritten twice correspondingly to the write of the firstcontent. For this reason, when content write has been made a smallnumber of times, a specified number of times for rewrite of the flashmemory 61 will be reached, so that the flash memory 61 will not berewritable any longer.

To avoid the above, the portable device 6 makes the EEPROM 68 store FATthat FAT will be rewritten a reduced number of times in the flash memory61 at write of each content.

By storing into the EEPROM 68 a FAT which is rewritten a large number oftimes, the portable device 6 can be adapted such that content can bewritten into the flash memory 61 at a frequency tens times larger thanthat at which FAT is stored into the flash memory 61. Further, since theCPU 53 makes the EEPROM 68 additionally store FAT, the same area in theEEPROM 68 is rewritten at a reduced frequency to prevent the EEPROM 68from early becoming not rewritable.

When the portable device 6 is connected to the personal computer 1 bythe USB cable 7 (which will be referred to as “USB connection”hereinafter), it is recognized based on an interrupt signal suppliedfrom the USB controller 57 to the CPU 53 that the USB connection hasbeen made.

When the portable device 6 recognizes the USB connection, it is suppliedwith an external power of a specified current value from the personalcomputer 1 via the USB cable 7, and makes a power circuit 52 stop thepower supply from the dry cell 51.

When the USB connection is established, the CPU 53 will stop the DSP 59from playing back a content. Thus, the CPU 53 will prevent the externalpower supplied from the personal computer 1 from exceeding the specifiedcurrent value so that the external power of the specified current valuecan always be supplied.

Thus, when the USB connection is established, the CPU 53 makes aselection between the power supplied from the dry cell 51 and the powersupplied from the personal computer 1. That is, the inexpensive externalpower from the personal computer 1 can be used, and so the costly powersupplied from the dry cell 51 and which costs high is less consumed.Thus, the dry cell 51 can be used for a longer service life.

Note that when supplied with the external power from the personalcomputer 1 via the USB cable 7, the CPU 53 stops the DSP 59 from playingback a content to reduce the radiation from the DSP 59, so that theradiation of the entire system including the personal computer 1 canfurther be reduced.

The functions of the personal computer 1 implemented by execution ofprograms installed in the personal computer 1 will be explained in thefollowing.

Referring now to FIG. 4, there is illustrated a diagram of the personalcomputer 1, explaining the functions of the personal computer 1,implemented by execution of predetermined programs.

As shown, the personal computer 1 uses a content management program 111which is composed of a plurality of programs including an EMD selectionprogram 131, check-in/check-out management program 132, copy managementprogram 133, move management program 134, encryption method conversionprogram 135, compression method conversion program 136, encryptionprogram 137, compression/expansion program 138, usage rule conversionprogram 139, usage rule management program 140, authentication program141, decryption program 142, PD driver 143, purchase programs 144 and145.

Of the above programs, the content management program 111 is composed ofshuffled or encrypted instructions, for example, to conceal theinstructed operations from outside to make it difficult to interpret theinstructions (for example, even if the user can read directly thecontent management program 111, he or she cannot identify theinstructions.

The EMD selection program 131 is not included in the content managementprogram 111 when the latter is installed in the personal computer 1 butit is received from the EMD registration server 3 via the network 2 atthe time of EMD registration. The EMD selection program 131 selects aconnection with the EMD server 4 (4-1 to 4-3) to enable a purchaseapplication program 115, purchase program 144 or 145 to have acommunication with the EMD server 4 (4-1 to 4-3) (e.g., download of acontent for purchase).

Based on a setting of either check-in or check-out and usage rule files162-1 to 162-N recorded in a content data base 114, thecheck-in/check-out management program 132 checks out contents stored incontent files 161-1 to 161-N to any of the portable device 6, or checksin contents stored in the portable device 6.

In response to the check-in or check-out having been done, thecheck-in/check-out management program 132 updates the usage rule storedin the usage rule files 162-1 to 162-N recorded in the content data base114.

Based on the usage rule files 162-1 to 162-N recorded in the contentdata base 114, the copy management program 133 copies contents stored inthe content files 161-1 to 161-N to any of the portable device 6, orcopies contents from the portable device 6 to the content data base 114

Also based on the usage rule files 162-1 to 162-N recorded in thecontent data base 114, the move management program 134 moves contentsstored in the content files 161-1 to 161-N to any of the portable device6, or contents from the portable device 6 to the content data base 114.

The encryption method conversion program 135 converts, to the sameencryption method as that used with the contents stored in the contentfiles 161-1 to 161-N recorded in the content data base 114, theencryption method used with a content the purchase application program115 receives from the EMD server 4-1 via the network 2, a content thepurchase program 144 receives from the EMD server 4-2 via the network 3.

The compression method conversion program 136 converts, to the samecompression method as that used with the contents stored in the contentfiles 161-1 to 161-N recorded in the content data base 114, thecompression method used with a content the purchase application program115 receives from the EMD server 4-1 via the network 2, a content thepurchase program 144 receives from the EMD server 4-2 via the network 2.

The encryption program 137 is used to encrypt a content (not encrypted)read from a CD and supplied from a recording program 113 for example tothe same encryption method as that used with contents stored in thecontent files 161-1 to 161-N recorded in the content data base 114.

The compression/expansion program 138 encodes a content (not compressed)read from a CD and supplied from the recording program 113 by the sameencoding method as that used with contents stored in the content files161-1 to 161-N recorded in the content data base 114. In addition, thecompression/expansion program 138 will expand (decrypt) a coded content.

The usage rule conversion program 139 converts, to the same format asthat of the usage rule stored in the usage rule files 162-1 to 162-Nrecorded in the content data base 114, a usage rule for a content thepurchase application program 115 receives from the EMD server 4-1 viathe network 2, a content the purchase program 144 receives from the EMDsever 4-2 via the network 2.

Before execution of content copy, move, check-in or check-out, the usagerule management program 140 detects a falsification or alteration of theusage rules based on hash values (which will further be described later)meeting the usage rules stored in the usage rule files 162-1 to 162-Nrecorded in the content data base 114. As the usage rules stored in theusage rule files 162-1 to 162-N recorded in the content data base 114are updated along with a content copy, move, check-in or check-out, theusage rule management program 140 updates the hash values meeting theusage rules.

The authentication program 141 executes a mutual authentication betweenthe content management program 111 and purchase application program 111,and a mutual authentication between the content management program 115and purchase program 144. Also, the authentication program 141 willstore an authenticate key used in the mutual authentication between theEMD server 4-3 and purchase program 145.

It should be noted that when the content management program 111 isinstalled in the personal computer 1, the authenticate key theauthentication program 141 used in the mutual authentication is not yetstored in the authentication program 141 but when adisplay/operation-instructive program 112 has successfully registeredthe authenticate key, the key will be supplied from the EMD registrationserver 3 and stored in the authentication program 141.

The decryption program 142 decrypts a content when the personal computer1 plays back the content stored in the content files 161-1 to 161-Nrecorded in the content data base 114.

When checking put a predetermine content to the portable device 6 orchecking in a predetermined content from the portable device 6, the PDdriver 143 supplies the portable device 6 with the content or a commandmaking the portable device 6 do a predetermined operation.

The purchase program 144 is installed along with the content managementprogram 111 into the personal computer 1, supplied from the EMDregistration server 3 via the network 2, or supplied as recorded in apredetermined CD. When installed in the personal computer 1, thepurchase program 144 will transmit or receive the content managementprogram 111 and data via an interface of a predetermined form thecontent management program 111 has.

The purchase program 144 is composed of shuffled or encryptedinstructions, for example, to conceal the instructed operations fromoutside to make it difficult to interpret the instructions (for example,even if the user can read directly the purchase program 144, he cannotidentify the instructions.

The purchase program 144 requests, via the network 2, the EMD server 4-2to send a predetermined content and thus receives the content from theEMD server 4-2. Upon reception of the content from the EMD server 4-2,the purchase program 144 will account for the content.

The purchase program 145 is to be installed along with the contentmanagement program 111. It requests, via the network 2, the EMD server4-3 to send a predetermined content and thus receives the content fromthe EMD server 4-3. Upon reception of the content from the EMD server4-3, the purchase program 145 will account for the content.

Based on a filtering data file 181, display data file 182, image files183-1 to 183-K or a history data file 184, thedisplay/operation-instructive program 112 displays an image of apredetermined window on the display unit 20, and gives a check-in orcheck-out instruction to the content management program 111 in responseto an operation of the keyboard 18 or mouse 19 by the user.

The filtering data file 181 stores data for weighting contents stored inthe content files 161-1 to 161-N recorded in the content data base 114,and is recorded in the HDD 21.

The display data file 182 stores data corresponding to the contentsstored in the content files 161-1 to 161-N recorded in the content database 114, and is recorded in the HDD 21.

The image files 183-1 to 183-K store images corresponding to the contentfiles 161-1 to 161-N recorded in the content data base 114 or imagescorresponding to packages which will further be described later, and arerecorded in the HDD 21.

The image files 183-1 to 183-K will be referred to simply as “image file183” hereafter wherever they have not be referred to individually.

The history data file 184 stores history data including a number oftimes the contents stored in the content files 161-1 to 161-N recordedin the content data base 114 have been checked out, a number of timesthe contents have been checked in, and the dates on which the check-outan check-in were made. The history data file 184 is recorded in the HDD21.

For the registration, the display/operation-instructive program 112transmits, via the network, an ID of the pre-stored content managementprogram 111 to the EMD registration server 3, while receiving, via thenetwork 2, the authenticate key and EMD selection program 131 from theEMD registration server 3 and supplying them to the content managementprogram 111.

The recording program 113 is used to display an image of a predeterminedwindow, and read data such as a recording time of a content from a CDbeing the optical disc 42 set in the drive 22 in this embodiment inresponse to an operation of the keyboard 18 or mouse 19 by the user.

Based on a recording time of a content recorded in a CD, the recordingprogram 113 requests, via the network 2, the WWW server 5-1 or 5-2 tosend data corresponding to the CD such as album name or artist's name ordata corresponding to a content recorded in the CD such as a music piecetitle, and thus receives, via the network 2, the data corresponding tothe CD or the content recorded in the CD from the WWW server 5-1 or 5-2.

Also, the recording program 113 supplies thedisplay/operation-instructive program 112 with the received datacorresponding to the CD or data corresponding to the content recorded inthe CD.

Further, when supplied with a recording instruction, the recordingprogram 113 reads and outputs to the content management program 111 acontent from a CD being the optical disc 42 set in the drive 22 in thisembodiment.

The content data base 114 stores into any of the content files 161-1 to161-N a content supplied from the content management program 111 andhaving been compressed in a predetermined manner and encrypted in apredetermined manner (records the content into the HDD 21). The contentdata base 114 stores usage rules for contents stored in the contentfiles 161-1 to 161-N into any of the usage rule files 162-1 to 162-Ncorresponding to the content files 161-1 to 161-N in which the contentsare stored (records the usage rules into the HDD 21).

The content data base 114 may record the content files 161-1 to 161-N orusage rule files 162-1 to 162-N as records.

A usage rule for a content stored in the content file 161-1 for exampleis stored in the usage rule file 162-1. A usage rule for a contentstored in the content file 161-N is stored in the usage rule file 162-N.

The content files 161-1 to 161-N will be referred to simply as “contentfile 161” hereinafter wherever they have not be referred toindividually. Also, the usage rule files 162-1 to 162-N will be referredto simply as “usage rule file 162” hereafter wherever they have not tobe referred to individually.

The purchase application program 115 is supplied from the EMDregistration server 3 via the network 2 or as recorded in apredetermined CD-ROM. The purchase application program 115 requests, viathe network 2, the EMD server 4-1 to send a predetermined content, whilethus receiving the content from the EMD server 4-1 and supplying it tothe content management program 111. Also, upon reception of the contentfrom the EMD server 4-1, the purchase application program 115 willaccount for the content.

Next, the correspondence between data stored in the display data file 82and the content files 161-1 to 161-N stored in the content data base 114will be described herebelow:

Firstly, a content stored in any of the content files 161-1 to 161-Nbelongs to a predetermined package. More specifically, the package isany of an original package, my selected package and filtering package.

Of the above packages, the original package has more than one contentbelonging thereto. This package corresponds to the contentclassification (namely, so-called album) in the EMD server 4 or to oneCD. A content belongs to any original package and cannot belong to aplurality of original packages. Also, an original package to which acontent belongs cannot be modified. The user can edit a part ofinformation corresponding to an original package (for example, additionof information or change of added information).

More than one content freely selected by the user belong to the myselected package. The user can arbitrarily edit contents for assignmentto my selected packages, respectively. A content can belong to more thanone my selected package at a time. Also, a content may not belong to anymy selected package.

Contents selected based on a filtering data stored in a filtering datafile 181 belong to the filtering package. The filtering data is suppliedfrom the EMD server 4 or WWW server 5 via the network 2 or as recordedin a predetermined CD. The user can edit the filtering data stored inthe filtering data file 181.

The filtering data is a reference for selection of a predeterminedcontent or for calculation of a weight corresponding to the content. Forexample, filtering data corresponding to top tens of the weekly J-POP(Japanese pops) can be used by the personal computer 1 to identifycontents of the weekly Japan Pops Nos. 1 to 10.

The filtering data file 181 includes a filtering data for selection ofcontents in the descending order of the lengths of period for which theyhave been checked out for the past one month, a filtering data forselection of contents in the descending order of the numbers of timesthey have been checked out for the past half year, or a filtering datafor selection of contents in which a character “AI(love)” is included inthe music piece titles (content name).

Thus, contents in the filtering package are selected by comparing afiltering data with a content display data 221 (including data the userhas set), a history data 184 or the like.

The driver 117 drives the audio input/output interface 24 under thecontrol of the content management program 111 or the like to input acontent being a digital data supplied from outside and supply it to thecontent management program 111, output as a digital data a contentsupplied from the content data base 114 via the content managementprogram 111, or output an analog signal corresponding to a contentsupplied from the content data base 114 via the content managementprogram 111.

FIG. 5 shows an example of the display/operation-instructive window thedisplay/operation-instructive program 112 makes the display unit 20display.

There are displayed in the display/operation-instructive window a button201 for starting up the recording program 113, a button 202 for startingup the EMD selection program 131, a button 203 for displaying a field inwhich check-in or check-out is set, a button 204 for displaying a fieldin which a my selected package is to be edited, etc.

When a button 205 is selected, data corresponding to an original packageis displayed in a field 211 of the window. When a button 206 isselected, data corresponding to a my selected package is displayed inthe field 211. When a button 207 is selected, data corresponding to afiltering package is displayed in the field 211.

Data displayed in the field 211 concerns a package. For example, it is apackage name or an artist's name.

As shown in FIG. 5, there are displayed in the field 211 a package name“FIRST” and artist's name “A TARO”, a package name “SECOND” and artist'sname “A TARO”, etc.

The display/operation-instructive window has also a field 212 in whichthere is displayed data corresponding to a content belonging to a packetselected in the field 211. Data displayed in the field is a music piecetitle, playing time or a number of times the content can be checked out.

In FIG. 5, a package corresponding to the package name “SECOND” isselected. So, there are displayed in the field 212 the music piece title(content name) “MINAMI-NO-SAKABA” corresponding to the content belongingto the package corresponding to the package name “SECOND”, a number oftimes the content can be checked out (for example, one eighth note isfor one check-out and two eighth notes are for two check-out's), andmusic piece title (content name) “KITA-NO-HAKABA” and number of timesthe content can be checked (for example, one eighth note corresponds toone check-out).

Thus, one eighth note as a number of times a content can be checked out,displayed in the field 212, indicates that a corresponding content canbe checked out once.

A rest as a number of times a content can be checked out, displayed inthe field 212, indicates that a corresponding content cannot be checkedout (the number of check-out's is zero; however, the personal computer 1can play back that content). A C clef as a number of times a content canbe checked out, displayed in the field 212, indicates that the number ofcheck-out's for a corresponding content is limitless (the content can bechecked out any number of times).

Note that the number of times a content can be checked out may beindicated with a corresponding number of pieces of a predeterminedfigure (for example, it may be a circle, star, crescent or the like) asshown in FIG. 5 as well as a number.

Also there is displayed in the display/operation-instructive window afield 208 in which an image or the like corresponding to a selectedpackage or content (corresponding to any of the image files 183-1 to183-K in FIG. 4) is displayed. In this field, a button 209 is clickedwhen playing back a selected content (outputting a sound correspondingto the content to the speaker 45).

When a music piece title of a predetermined content (content name)displayed in the field 212 is selected and a deleting operation is madewhile the button 205 is selected and data corresponding to an originalpackage is being displayed in the field 211, thedisplay/operation-instructive program 112 will make the contentmanagement program 111 delete the predetermined content stored in thecontent data base 114, corresponding to the selected music piece title.

When a content read from a CD is recorded into the content data base 114while a button 255 (which will further be described later) in the windowdisplayed under the control of the recording program 113 is beingselected. (made active), the display/operation-instructive program 112will make the display/operation-instructive window display a field 213in which there is displayed a music piece title of a content (contentname) stored in the pre-designated portable device 6.

When a content read from a CD is recorded into the content data base 114while a button 255 (which will further be described later) in the windowdisplayed under the control of the recording program 113 is beingselected (made active), the display/operation-instructive program 112will make the content management program 111 check out the contentrecorded in the content data base 114 and read from the CD to thepre-designated portable device 6.

There is displayed in the field 213 at the leftmost position thereofcorresponding to the music piece title of a content (content name) asymbol indicating whether the content can be checked in to the personalcomputer 1. For example, a symbol “∘” at the leftmost position of thefield 213 indicates that a content corresponding to a music piece titleof a content can be checked in to the personal computer 1 (that is, ithas been checked out from the personal computer 1). A symbol “×” at theleftmost position of the field 213 indicates that a contentcorresponding to a music piece title of a content cannot be checked into the personal computer 1 (that is, it has not been checked out fromthe personal computer 1; for example, it has been checked out from anyother personal computer).

When the display/operation-instructive program 112 has displayed thefield 213 in the display/operation-instructive window, thedisplay/operation-instructive program 112 will display in thedisplay/operation-instructive window a field 214 in which the name of aportable package (to which a content stored in the pre-designatedportable device 6 belongs) is displayed, a button 210 to close the field213, and a button 215 to execute a check-in or check-out operation.

Further, when the display/operation-instructive program 112 hasdisplayed the field 213 in the display/operation-instructive window, thedisplay/operation-instructive program 112 will display in thedisplay/operation-instructive window a button 216 to set a check-outoperation for a content corresponding to a music piece title selected inthe field 212, a button 217 to set a check-in operation for a contentcorresponding to a music piece title selected in the field 213, a button218 to set a check-in operation for all contents corresponding tocontent names displayed in the field 213, and a button 219 to cancel thecheck-in or check-out setting.

Even with the check-in or check-out setting made by using the buttons216 to 219, however, the personal computer 1 will not execute thecheck-in or check-out operation.

When the button 215 is clicked after a check-in or check-out is set byusing the buttons 216 to 219, the display/operation-instructive program112 will make the content management program 111 execute the check-in orcheck-out. That is to say, when the button 215 is clicked, thedisplay/operation-instructive program 112 will make, based on thecheck-in or check-out setting, the content management program 111transmit a content, or a command to erase a predetermined contentcorresponding to the check-in setting (e.g., a command to erase apredetermined content stored in the portable device 6), to the portabledevice 6, and to update the usage rule stored in the usage rule file 162corresponding to the content or command thus transmitted.

When the check-in or check-out is executed, thedisplay/operation-instructive program 112 will respond to thetransmitted content or command to update the history data stored in thehistory data file 184. The history data includes information foridentification of a content having been checked in or out or a date whenthe content has been checked in or out, and the name of the portabledevice 6 from which the content has been checked out.

Since the check-in or check-out can be set in a short time, the user canquickly know the status after execution of a check-in or check-outoperation, whereby the number of times a time-taking check-in orcheck-out operation is done can be reduced to minimize the total time(including the setting and execution of a check-in or check-outoperation) taken for the check-in or check-out procedure.

FIG. 6 shows an example of the window which the recording program 113 tomakes the display unit 20 display.

Based on CD information received from the WWW server 5-2 for example,the recording program 113 will display a CD title such as“ACYNCHRONIZED” in a field 251. Also, based on CD information receivedfrom the WWW server 5-2, the recording program 113 will display anartist's name such as “KUWAI” in a field 252.

Based on CD information received from the WWW server 5-2, the recordingprogram 113 will display titles of music pieces such as “HEAT”,“PLANET”, “BLACK”, “SOUL”, etc. in a region of a field 253 where musicpiece titles are to be displayed. Similarly, the recording program 113will display an artist's name such as “KUWAI” is a region of the field253 where artists' names are to be displayed.

After receiving a predetermined CD information, the recording program113 will store it into a predetermined directory in the HDD 21.

Upon reception of an instruction for acquisition of CD information viaclicking of a button 254, the recording program 113 will first searchthe predetermined directory in the HDD 21. When the CD information isfound stored in the directory, the recording program 113 will display adialogue box (not shown) to prompt the user for selection of whether heor she is going to use the CD information stored in the directory.

When a button 256 displayed in the window displayed by the recordingprogram 113 and which instructs to start recording of a content, isclicked, the recording program 113 will read a content from a CD set inthe drive 22, and supply it along with the CD information to the contentmanagement program 111. The compression/expansion program 138 of thecontent management program 111 compresses the content supplied from therecording program 113 in a predetermined manner, and the encryptionprogram 137 encrypts the compressed content. Also, the usage ruleconversion program 139 generates a usage rule for the compressed andencrypted content.

The content management program 111 will supply the compressed andencrypted content along with the usage rule to the content data base114.

The content data base 114 will generate a content file 161 and usagerule file 162 for the content received from the content managementprogram 111, and store the content into the content file 161 and theusage rule into the usage rule file 162.

When the content and usage rule for the content are stored into thecontent data base 114, the content management program 111 will supplythe CD information and usage rule received from the recording program113 to the display/operation-instructive program 112.

The display/operation-instructive program 112 will a display data forstorage into the display data file 182 according to the usage rule forthe content stored in the content data base 114 by the recording and theCD information.

The window displayed by the recording program 113 has displayed thereina button 255 to automatically set whether the portable device is made tocheck out a content read from the CD when the content read from the CDis recorded into the content data base 114.

For example, when the button 255 is clicked, the recording program 113will display a pull-down menu showing the portable device 6. When theuser selects the portable device 6 from the pull-down menu, the personalcomputer 1 will automatically check out the content recorded from the CDto the selected portable device 6. When the user selects “NOT CHECK OUT”from the pull-down menu, the personal computer 1 will not check out thecontent recorded from the CD.

Thus, when the content read from the CD is recorded into the contentdata base 114 with only the button 255 in the window displayed by therecording program 113 being set active, the personal computer 1 can makeany pre-designated one of the portable devices 6-1 to 6-3 check out thecontent read from the CD.

(2) Handling Between Different Formats

Meanwhile, there are numerous contents distributors furnishing the musiccontents, with the encryption systems of the contents and the formats ofthe using condition information differing from one distributor toanother. So, the user at larger has to purchase contents managementapplications or portable devices for reproduction or check-in/check-outdifferent from one distributor of contents desired to be furnished toanother, and hence the user cannot handle the music contents stored on apersonal computer by a sole management application or by a sole portabledevice.

So, the present system envisages to handle the contents having differentformats from one distributor to another on the personal computer 1 in aunified fashion.

Referring to FIG. 7, unified handling of contents having differentformats from one distributor to another, in this music contentsdistributing system, is explained with reference to FIG. 7.

It is assumed that the plural EMD servers 4, connected to the network 2,are an EMD server A4-1, distributing the music contents furnished by amusic furnishing firm A, an EMD server B4-2, distributing the musiccontents furnished by a music furnishing firm B and an EMD server X4-3,distributing the music contents furnished by a music furnishing firm X.These EMD servers 4 (4-1, 4-2 and 4-3) furnish the music contents of aline-up each being unique to each firm, over a network 2 to a personalcomputer 1 owned by a user. Moreover, the respective EMD servers 4 (4-1,4-2 and 4-3) distribute the music contents in respective differentstyles, by the servers 4 adopting encryption systems of music contents,formats of the using condition (usage rule) information, music contentscompression systems and charging systems for the motion compensation,which are unique to the servers.

In the personal computer 1, there are installed, as application softwarefor reproduction or management of the music contents, a reproductionapplication A311, for purchasing, supervising and reproducing musiccontents from the EMD server A41, a reproduction application. B312, forpurchasing, supervising and reproducing music contents from the EMDserver B4-2, a device driver A313 for transferring the music contents tothe portable device A6-1 and a device driver B314 for transferring themusic contents to the portable device B6-2. Meanwhile, the reproductionapplication 311, 312, shown in FIG. 7, correspond to the applicationprogram 115 for purchase and the driver 117, shown in FIG. 4,respectively.

In the personal computer 1, there are installed a comprehensivemanagement unit X 315, for managing comprehensive control of thetotality of music contents stored in the HDD 21. This comprehensivemanagement unit X 315 is made up of a reception interface 316 for EMD, atransmission interface for EMD 317 and a driver for PD 318.

It is assumed here that the portable device A6-1 is a dedicated devicefor coping with a music furnishing firm A, the portable device B6-2 is adedicated device for coping with a music furnishing firm B and theportable device X6-3 is a dedicated device for coping with a musicfurnishing firm X. It is also assumed that the music contents stored ina memory card are encrypted in accordance with an encryption systemunique to each music furnishing firm, with the formats for the usingcondition information or the compression systems being also different,so that no music contents can be transferred on connection directlye.g., to other device drivers.

The reproduction application A 311 performs the processing forconnecting to the EMD server, uploading e.g., a log file and downloadingmusic contents, contents keys and using condition information. Thisreproduction application A311 is adapted for performing connectionprocessing only to the EMD server the application is able to cope with.Here, the reproduction application A311 is adapted for performing theprocessing associated with the EMD server 4-1, while it is unable toperform connection processing to any other EMD servers. The reproductionapplication A311 also is adapted for performing the processing forauthentication on connection to the EMD server A4-1, the processing forauthentication on connection to the portable device A6-1 and theprocessing for encryption/decryption of the music contents and the usingcondition information stored in the HDD 21. The reproduction applicationA311 encrypts the music contents, downloaded from the EMD server 4-1 andthe corresponding using condition information with the contents key andencrypts the contents key with the session key to store the encryptedkey in the HDD 21. Meanwhile, the respective reproduction applicationsadopt respective unique encryption systems, so that the music contentsstored in the same HDD 21 in the personal computer 1 cannot decryptother reproduction applications than the dedicated reproductionapplication.

The reproduction application A311 also manages the using conditioninformation appended to each music contents. For example, if a limitvalue for the number of times of reproduction is stated in the usingcondition information, such that limitations are imposed on the numberof times of possible contents reproduction, the reproduction applicationA311 decrements the limit value of the number of times of reproductionor duplication by 1 for each reproduction or duplication.

The reproduction application A311 also transmits the music contents andthe using condition information it manages on the HDD 21 to thereception interface 316 for EMD of the comprehensive management unit X315.

The reproduction application B312 performs the processing of connectionto the EMD server, uploading e.g., a log file and downloading the musiccontents, contents key or the using condition information. Thisreproduction application B312 is adapted for performing the processingfor connection only to the EMD server the application is able to copewith. Specifically, the reproduction application B312 is able to performthe processing associated with the EMD server 4-2, while it is unable toperform the processing for connection to the other EMD servers. Thereproduction application B312 performs the processing for authenticationon connection to the EMD server 4-2, the processing for authenticationon connection to the portable device B6-2 and the processing forencrypting/decrypting the music contents and the using conditioninformation stored in the HDD 21. For example, the reproductionapplication B312 encrypts the music contents downloaded from the EMDserver 4-2 and the corresponding using condition information, with thecontents key, while encrypting the contents key with a session key andsaving the encrypted contents key in the HDD 21.

The reproduction application B312 also manages the using conditioninformation appended to the respective music contents. For example, if alimit value for the number of times of reproduction is stated in theusing condition information, such that limitations are imposed on thenumber of times of possible contents reproduction, the reproductionapplication B312 decrements the limit value of the number of times ofreproduction or duplication by 1 for each reproduction or duplication.

The reproduction application B312 also transmits the music contents andthe using condition information it manages on the HDD 21 to thereception interface 316 for EMD of the comprehensive management unit X315.

The device driver A313 is an application software for transferring musiccontents to the portable device A6-1. The device driver A313 transmitsthe music contents to the portable device A6-1.

The device driver B314 is an application software for transferring musiccontents to the portable device B6-2. The device driver B314 transmitsthe music contents to the portable device B6-2.

The comprehensive management unit (X)315 is an application software,dedicated to the music furnishing company X, and which is furnished withthe music contents from the EMD server (X)4-3. The comprehensivemanagement unit (X)315 is also a supervising software for transferringthe music contents and the using condition information between it andthe device driver (A)313, device driver (B)314, reproducing application(A)311 and the reproducing application (B)312 to manage the musiccontents in the personal computer 1 comprehensively. The comprehensivemanagement unit (X)315 is also able to transfer the music contents it issupervising to the dedicated portable device 6-3 which is the portablemusic reproduction device.

The comprehensive management unit (X)315 performs processingcorresponding to the content management program 111 shown in FIG. 4.

The projection display unit 318 is an interfacing module for connectionto the portable device 6-3 and executes the authentication processingand the encryption processing between it and the portable device 6-3.Moreover, in transferring music contents etc to other portable devices6-1, 6-2, the projection display unit 318 transfers the music contentsand the using condition information through the device driver (A) 313 orthe device driver (B)314.

The reception interface for EMD 316 receives the music contents and theusing condition information from the reproducing application (A)311 andthe reproducing application (B)312, while receiving the music contentsand the using condition information transferred from the EMD server(X)4-3 through the network 2 and exchanging the music contents and theusing condition information with the PD driver 318.

In receiving the music contents and the using condition information fromthe reproducing application (A)311 and the reproducing application(B)312, the reception interface for EMD 316 performs reciprocalauthentication, conversion of the encryption system, conversion of theformat for the using condition information etc., appended to the musiccontents being transferred and conversion of the compression system ofthe music contents being transferred. The encryption system, usingcondition information or the compression system used by the reproducingapplication (A)311 and the reproducing application (B)312 is changed tothe system used by the comprehensive management unit (X)315. The systemused by the comprehensive management unit (X)315 is referred to below asa unified transfer protocol. The reception interface for EMD 316transmits the music contents and the using condition information, thusconverted to the unified transfer protocol, the device driver (A)313 orthe device driver (B)314 through the PD driver 318. The receptioninterface for EMD 316 also transmits the music contents and the usingcondition information, converted to the unified transfer protocol, tothe portable device 6-3 through the PD driver 318.

The music contents provided from the EMD server (A)4-1 and the EMDserver (B)4-2 are once downloaded by the reproducing application (A)311and the reproducing application (B)312, and the encryption system, thecompression system, and the using condition information of the musiccontents are converted to the unified transfer protocol and aretransferred to the comprehensive management unit (X)315. Thecomprehensive management unit (X)315 comprehensively supervises themusic contents of the contents furnishing companies downloaded from theEMD server (A) 4-1, EMD server (B)4-2 and from the EMD server (X)4-3.

The reception interface for EMD 316 also has the function of copying,moving, and performing check-in and check-out of the music contents.

The reception interface for EMD 316 performs the processing of copyingor moving the music contents stored in the reproducing application(A)311 to the reproducing application (B)312, in accordance with thecommand for copying or movement from the user. At this time, thereception interface for EMD 316 converts the encryption system of themusic contents, compression system or the statement format of the useconditions into the unified transfer protocol.

The reception interface for EMD 316 also performs the processing ofcopying and checking-in the music contents stored in external media,such as Compact Disc, or in the portable devices 6-1 to 6-3, into thecomprehensive management unit (X)315, in accordance with the CD rippingcommand or the check-in command from the user. If, at this time, theencryption system or the compression system of the music contents or thedescription format of the using conditions are not converted to theunified transfer protocol, the reception interface for EMD 316 makes theconversion into the unified transfer protocol.

The reception interface for EMD 316 also performs the processing ofrecording the music contents managed by the comprehensive managementunit (X)315 in the portable device 6-3 in accordance with a check-outcommand from the user. If, at this time, the encryption system or thecompression system of the music contents or the description format ofthe using conditions are not converted to the unified transfer protocol,the reception interface for EMD 316 makes the conversion into theunified transfer protocol. Also, at this moment, the available number ofcheck-out of the using condition is decreased by one.

The comprehensive management unit (X)315 has the unified transferprotocol in a lower application layer in which to transfer data to otherpurchase applications, as shown in FIG. 8. The comprehensive managementunit (X)315 has data transmission/reception with the EMD server (X)4-3,with a layer below the unified transfer protocol as http (hyper texttransfer protocol).

In the above-described music contents distributing system, the musiccontents distributed from the EMD server (A)4-1 and the EMD server(B)4-2 are acquired by the comprehensive management unit (X)315 forreproduction or management; Also, the music contents distributed fromthe EMD server (X)4-3, EMD server (A)4-1 and the EMD server (B)4-2 aretransferred to the portable device (X)6-3.

In the music contents distributing system, as described above, mainlythe comprehensive management unit (X)315 operates to convert theencryption system for music contents to be transferred, the format ofthe using condition information appended to the music contents to betransferred or the compression system of the music contents to betransferred, in association with the respective reproducing applicationsand the device drivers, to effectuate transfer of the music contentswith the aid of the unified transfer protocol. So, the music contentsdownloaded by the reproducing application (A)311 from the EMD server(A)4-1 and the music contents downloaded by the reproducing application(B)312 from the EMD server (B)4-2 can be transferred to thecomprehensive management unit (X)315 so that the music contents of anartist furnished only by e.g., the music furnishing company A can betransferred to the portable device (X)6-3. That is, since the presentmusic contents distributing system converts the encryption system ofmusic contents, format of the using condition information and thecompression system for the music contents into the unified transferprotocol, the music contents of variable systems, stored in the harddisc of the personal computer 1, can be reproduced by the comprehensivemanagement unit (X)315 or the portable device (X)6-3. In particular,since the music contents distributing system converts the encryptionsystem and the using condition information at the time of transfer, thedegree of freedom in handling the music contents can be enhanced whileprotection of the copyrights of the music contents is assured.

That is, in the music contents distributing system, at least theencryption system and the using condition information are convertedbetween reproducing applications adapted for reproducing or controllingthe music contents to transfer the music contents and the usingcondition information. By so doing, the music contents distributingsystem is able to move the music contents stored in e.g., the hard disc21 in the personal computer 1, even if there are plural reproducingapplications, thus enabling unified management of the music contents.Moreover, since the using condition information is transferred alongwith the music contents, there is no risk of the using conditionsoverlapping with sole music contents thus assuring more reliableprotection of the music contents.

(3) Using Condition Information

(Explanation of Routinely Used Using Condition Information)

A typical format of the using condition information used in thereproducing application (A)311 is now explained.

In the reproducing application (A)311, the using condition information,represented by a tabulated form shown for example, in FIG. 3a, is used.

In the left and right columns of the Table are stated, in the columnardirection, the policies of the using conditions and specified values ofthe policies, respectively. For example, the possible replay date(from), replay end date (to) or the cost per replay (pay/play) arestated as policies. The using condition information is distributed fromthe EMD server (A)4-1 as the information is appended to each musiccontents, as shown in FIG. 9B. The reproducing application (A)311controls the music contents in accordance with the stated policies andthe corresponding values. For example, assume that the possible replaydate (from) is Oct. 25, 1999, replay end date (to) is Nov. 24, 1999 andthe cost per replay (pay/play) is yes/10 yen. In such case, the musiccontents can be reproduced as from Oct. 25, 1999 and reproductionthereof before this data is inhibited even if a replay command is issuedfrom the user. The music contents also can be reproduced until Nov. 24,1999 such that the music contents are erased as from this date. Themusic contents also are set so that 10 yen is assessed per replay. Thenumber of times of reproduction by the user is stored as the separatelog information which is uploaded to the EMD server (A)4-1 to assess theuser who heard or viewed by an amount corresponding to the number oftimes the music contents are heard or viewed.

(Explanation of the Using Condition Information as Used by theComprehensive Management Unit (X)315)

The using condition information, as used by the comprehensive managementunit (X)315, is now explained. The using condition information, nowexplained, is appended to the music contents downloaded from the: EMDserver (X)4-3, and is used when the comprehensive management unit (X)315manages control of the music contents. Moreover, the using conditioninformation is used as a unified format when reciprocally transferringmusic contents between the reproducing application (A)311 and thecomprehensive management unit (X)315 or between the reproducingapplication (A)311 and the comprehensive management unit (X)315. Thisusing condition information is referred to below as the unified usingcondition information.

The unified using condition information is made up of an index file 331,an automaton file 332, a parameter file 333 and a hysteresis file 334,as shown in FIG. 4. These files are stated in an XML (eXtensible MarkupLanguage) language.

In the index file 331 is stated e.g., the reference information of eachfile.

To the automaton file 332 are appended an automaton stating portion 341,stating the using conditions by automaton, an authentication code bycontents keys (MAC; Message Authentication Code) 342, a signature by acontents purveyor (Sig) 343 and a certificate for verifying thesignature (Cert) 344, as shown in FIG. 11. The contents key is denotedKC, whilst a private key and a public key of the contents purveyor whoprepared the contents are denoted K⁻¹ _(E) and K¹ _(E), respectively.

The automaton stating portion 341 describes the operating state of musiccontents by an Extended State Machine stated in tuple sequence.

With a set of the operating states of the current music contents Q andwith a set of input symbols representing the events of the musiccontents Σ, the automaton stating portion 341 expresses a set Q′ of theoperating states of the music contents following status transition asfollows:

Q′={d|d=δ(q,α)|qQ, αQ, δ: Q×Σ→Q}

As shown in this equation, the set Q′ of the operating states isexpressed as d. The d is defined by a function δ having variables q,α.The q indicates one operating state of the set Q of the operating statesof the music contents. The α indicates an event of the set of events Σ.The function δ is a map of a power set of Q and Σ to Q.

Based on the above Q, Σ, and Q′, each tuple is expressed by

{<q, α, d>|q, dεQ, αεΣ}.

Note that <q, α, d> indicates an example of permutation and combinationof q, α, d.

In Σ, events such as replay (play), copy (copy), amount (pay Y),possible play start date and time (from YMD), play end date and time (toYMD), number of usable days (in Ddays), or null event (ε), are stated asfollows:

Σ=(Play, copy, pay Y, from YMD, to YMD, in Ddays, ε).

So, the following statement is made in automaton descriptor 341.

A specified statement in the automaton descriptor 341 is hereinafterexplained.

An illustrative description by a tuple-row of the automaton,representing operation transition of music contents shown in FIG. 12, isshown in FIG. 13.

This automaton performs the status transitions as now explained.

First, transition is made from an initial state q0 to a state q1 and toa state q5. From the states q1 and q5, parallel movement occurs.

If a payment event of a pre-set amount, such as 10 yen (pay10) occurs inthe state q1, transition to the state q2 occurs. If the play event(play) occurs in the state q2, transition is made to the state q1. Thatis, the present automaton indicates that, if the payment of 10 yen ismade, the music contents may be reproduced only once. If a payment eventof a pre-set amount, such as 1000 yen (a.pay1000) occurs in the stateq1, transition is again made to the status q3. Specifically, thisautomaton indicates that, if the payment of 100 yen is made, the musiccontents can be reproduced without regard to the number of times. If apayment event in an amount corresponding to n times the reproductionamount for one reproduction, such as 10 yen (pay10×n) occurs, transitionis made to the status q4. If, after transition to the status q4, theplay event (play) occurs, transition is again made to this state q4. Ifn play events occur in this state q4, transition is made to the statusq1. That is, in this automaton, it is shown that, if 10×n yen is paid,the music contents can be reproduced n times.

If a payment event of a pre-set amount, such as 100 yen, occurs in thestate q5, transition is made to the state q6. If a copy event occurs inthe state q6, transition is made to the state q5. If a copy event occursin the status q6, transition occurs to the status q8. If a play eventoccurs in the state q8, transition is again made to this state q8. If acopy event occurs in this state q8, transition is made to the state 9.This state q9 is a final state where no transition to other statesoccurs and no event occurs. That is, this automaton shows that, if 100yen is paid, the music contents can be copied once to other device.Moreover, this automaton shows that, although the music contents copiedcan be reproduced any desired number of times, reproduction isimpossible if once the music contents are copied to another device.

If the payment event of a pre-set amount, such as 2000 yen (a.pay2000)occurs in the state q5, transition is made to the state q7. If a copyevent occurs in the state q7, transition is again made to th is stateq7. If a copy event occurs in the state q7, transition is made to thestate q8. If a play event occurs in the state q8, transition is againmade to this state q8. If a copy event occurs in this state q8,transition is made to the state q9. This state q9 is a final state whereno transition to other states occurs and no event occurs. That is, thisautomaton shows that, if 2000 yen is paid, the music contents can becopied to another device a limitless number of times. Moreover, theautomaton shows that, although the copied music contents can bereproduced any desired number of times, the music contents, copied toanother device, can not be reproduced.

FIG. 13 shows a tuple row statement of the automaton performing theabove-described status transitions.

It is possible for the automaton stating portion 341 to state parallelsynthesis of operating states, in order to update the movement of musiccontents. For example, parallel synthesis of the operations a₀ and a₁may be represented by the tuple sequence as follows:

<q₀, α, a₀, q₀>

<q₀, α, a₁, q₀>

It is also possible to state an action accompanying the statustransition in the automaton stating portion 341. For example, the actionis represented by tuple as follows:

<q₀, α, q₁; action>

This action is represented as a function employing a pre-definedvariable. The variable is made up of an ID, a scope and an initialvalue. For example, with a variable n representing the purchasing priceof an album (a), statement is such that a.n:=1000. An example of theautomaton stating portion 341 stating an action with respect to thevariable is as shown below:

<q ₀, pay100, q ₁ , a.n:=a.n−100>  (1)

q₀, pay (a.n), q ₁ , a.n:=0>  (2)

<q₁, play, q₂>  (3)

This example indicates that the purchasing price of a sole musiccontents (equation (1)) affects the price of album purchase (equation(2)).

The above-described automaton stating portion 341 is made up of an entryID 345, a contents ID 346, version information 347, variable information348, and a tuple sequence 349, as shown in FIG. 14.

A specified example of the automaton stating portion 341 the descriptionformat of which has been defined will be described in the following.

Meanwhile, the events and commands used below as the automatondescriptions are defined by a DTD (Document Type Definition) specifiedon the basis of the XML specification. For example, the reproduction(play), duplication (copy), pay for play (pay-for-play), pay forduplication (pay-for copy), pay for album play (pay-for-album-play), payfor album duplication (pay-for-album-copy), possible use start date(from), use end date (to) and a null operation (null) are set as eventsby the DTD.

FIG. 16 shows an exemplary description of the automaton stating portion341 by the XML language indicating that the music contents can bereproduced as from Sep. 1, 1999.

The description shown in FIG. 16 is an automaton shown in FIG. 17. Theautomaton is constituted by the state q1 as an initial state and thestate q2. When the date becomes Sep. 1, 1999 which is a possible usestart date (from) in the state q1, the state is moved to the state q2.When the reproduction event (play) is generated in the state q2, themusic contents are reproduced, and the state is again moved to the stateq2. In such manner, the automaton controls to enable reproduction of themusic contents from Sep. 1, 1999.

FIG. 18 shows an exemplary description of the automaton stating portion341 by the XML language indicating that the music contents can bereproduced until Oct. 31, 1999.

The description shown in FIG. 18 is an automaton shown in FIG. 19. Theautomaton is constituted by the state q1 as an initial state and thestate end as an end state. When the reproduction event (play) isgenerated in the state q2, the music contents are reproduced, and thestate is again moved to the state q2. When the date becomes Oct. 31,1999 which is a use end date (to) in the state q2, the state is moved tothe state end. In the state end, the state is not moved to any state, orno event is generated. In such manner, the automaton controls to enablereproduction of the munic contents until Oct. 31, 1999.

FIG. 20 shows an exemplary description of the automaton slating portion341 by the XML language indicating that the possible reproduction timeperiod for the music contents is from Sep. 1, 1999 until Oct. 31, 1999,with the number of times of possible reproduction being 16.

The description shown in FIG. 20 is an automaton shown in FIG. 21. Theautomaton is constituted by the state q1 as an initial state, the stateq2 and the state end as an end state. When the date becomes Sep. 1, 1999which is a possible use start date (from) in the state q1, the state ismoved to the state q2. When the reproduction event (play) is generatedin the state q2, the music contents are reproduced, and the state isagain moved to the state q2. When the date becomes Oct. 31, 1999 whichis a use end date (to) in the stale q2, or the reproduction event isgenerated 16 times (play×16), the state is moved to the state end. Inthe state end, the state is not moved to any state, or no event isgenerated. In such manner, the automaton controls to define thereproduction period from Sep. 1, 1999 to Oct. 31, 1999, and to definethe number of reproduction to be 16 times.

FIG. 22 shows an exemplary description of the automaton stating portion341 by the XML language indicating that the number of times ofreproduction of the music contents is to be limited to 16.

To the parameter file 333 are appended a parameter statement portion351, authentication code 352 by contents key, a signature 353 by acontents purveyor, and a writ of authentication 354 verifying thesignature, as shown in FIG. 23. The contents key is denoted KC, whilstthe private key and the public key of the contents purveyor who preparedthe contents are denoted K⁻¹ _(E) and K¹ _(E), respectively.

The parameter file 333 can be rewritten by a contents purveyor otherthan the contents purveyor who prepared the automaton file 332, forexample, a secondary purveyor such as a contents retail dealer or by anintermediate contents distributor. To the parameter file 333 sorewritten is appended a unique entity ID 355 accorded to the purveyorsor to the intermediate distributor. Meanwhile, K′_(C) is the contentskey of the secondary purveyor, with K′_(C)=H(K_(C), Entity ID). Thecontents key K′_(C) of the secondary purveyor is formulated from thecontents key K_(C) of the primary purveyor. The primary and secondarypurveyors are distinguished from each other by the writs ofauthentication.

The parameter file 333 is verified by MAC if the contents key is alreadyto hand. If the contents key is not available for reasons pertinent tosafety, the parameter file 333 is verified by signatures andinstruments.

With the primary and secondary contents purveyors S and A, and with theterminal B, the protocol verified by MAC is as follows. S→A indicatestransmission from S to A, S→B indicates transmission from S to B, andA→B indicates transmission from A to B. ID_(A) indicates an ID of thedevice A.

S→A: K′ _(C) =H(K _(C) , ID _(A))

S→B: X=E _(Ks)(K _(C))1

A→B: ID _(A), Parameters, M=MACK′ _(C)(Parameters)

B: M≡MAC′ _(K′c)(Parameters)?

This parameter statement portion 351 states coefficients of a functionfor changing the values stated in the automaton stating portion 341 ofthe automaton file 332. For example, in the example shown in FIG. 13,there are occasions wherein the price of the music contents becomes afunction, as shown below:

<q ₀, pay (f ₁(10)), q ₁>

<q ₁, pay (f ₂(10)×n), q ₂>

In this case, the above functions f₁ and f₂ are defined, for example, asfollows:

f ₁(n)=0.9n

f ₂(n)=90+0.1n.

By defining the functions as above, it is possible for the primarypurveyor to set a default price value and for the second purveyor torewrite the parameter file 333 to change the price.

The above-described parameter statement portion 351 is made up of anentry ID 356, contents ID 357 and the coefficients information 358, asshown in FIG. 25.

The hysteresis file 334 is a file for stating the trajectory of theoperation of the music contents, operated based on the contents ofdescription, in the automaton stating portion 341. The status and thevariable in the tuple of the automaton stating portion 341 is recorded.For example, if reproduction is carried out twice in the example of FIG.13,

<q₀, q₁, q₀, q₁>

results, so that the trajectory of the following operation:

<pay10, play, pay10, play>

is obtained.

If this is summed and uploaded in e.g., the comprehensive managementunit (X)15, it is possible to compute the amount payable by the user.

In the music contents distributing system 1, in which the unified usingcondition information, representing the using condition by an automatonin which the policy itself and its concrete value are programmed, isused, it is possible to elevate the degree of freedom in the descriptionof the contents using conditions.

(4) Re-Storage and Re-Downloading of Destructed Music Contents

The backup of music contents by the comprehensive management unit (X)315is now explained.

First, the key management method of the comprehensive management unit(X)315 is explained by referring to FIG. 26.

The comprehensive management unit (X)315 stores the music contents C1,C2, C3, . . . Cn in the hard disc 21 in the personal computer 3. Thecomprehensive management unit (X)315 also stores the contents keys Kc1,Kc2, Kc3, . . . , Kcn, associated with the music contents C1, C2, C3, .. . Cn, respectively. The contents keys Kc are in a one-for-onecorrespondence to the music contents C. To the music contents C1, C2,C3, . . . Cn are appended the contents IDs for identification. Thesecontents IDs are termed CID1, CID2, CID3, . . . , CIDn.

The music contents C1, C2, C3, . . . Cn are encrypted by the contentskeys Kc1, Kc2, Kc3, . . . , Kcn and, in this state, are recorded in thehard disc 21 of the personal computer 3. E(K, C) denotes that thecontents C have been encrypted with the key K. Usually, the contents IDsare recorded in a header of the music contents C and encrypted alongwith the music contents C, or the MAC is appended to the music contentsC, such that the contents IDs are not separable from the main bodyportion of the music contents.

The contents keys Kc1, Kc2, Kc3, . . . , Kcn are encrypted by thestorage keys KS and are recorded in the state of E(SK, Kc1), E(SK, Kc2),E(SK, Kc3), . . . , E(SK, Kcn) in the hard disc 21 of the personalcomputer 1. This storage keys Ks exhibits so-called resistance to shortwavelength and is saved in a recording area that cannot be referenced byan ordinary user.

If, in the comprehensive management unit (X)315, where the keymanagement is performed as described above, the music contents C1, forexample, is to be reproduced, the contents key Kc1 is decrypted, usingthe storage key KS, and subsequently the music contents C1 is decrypted,using this contents key Kc1. In this manner, the comprehensivemanagement unit (X)315 is able to reproduce the music contents C1.

If, in the comprehensive management unit (X)315, where the keymanagement is performed as described above, the music contents C1 is tobe moved from the hard disc 21 to the portable device (X)6-3, reciprocalauthentication is performed with the portable device (X)6-3. Oncompletion of the authentication, the contents key Kc1 is decrypted bythe session key and the encrypted contents key Kc1 as well as theencrypted music contents C1 is transferred to the portable device(X)6-3. The contents key Kc1 and the encrypted music contents C1 areboth transferred to the portable device (X)6-3. The contents key Kc1 andthe music contents C1 are both erased from the hard disc 21. By sodoing, the comprehensive management unit (X)315 is able to move themusic contents C1 to the portable device (X)6-3.

The method of regenerating the music contents as becomes necessary whenthe music contents or the contents key cease to be reproducible from thehard disc 21 due to, for example, destruction of the hard disc 21, ishereinafter explained.

Usually, the comprehensive management unit (X)315 saves the backup dataof the encrypted music contents C and the contents key Kc in the harddisc 21.

Also, usually, the comprehensive management unit (X)315 is supervisingthe purchase records of the music contents downloaded form the EMDserver (X)4-3 and the list of the contents ID of the totality of themusic contents stored in the hard disc 21 as use log information. Thislog information is to be updated at the time of controlling of the musiccontents as when the music contents is downloaded from the EMD server(X)4-3 or moved to the portable device (X)6-3. The comprehensivemanagement unit (X)315 uploads the log information to the EMD server(X)4-3 periodically or after accessing.

If the music contents C or the contents key Kc stored in the hard disc21 of the comprehensive management unit (X)315 are destroyed, thefollowing processing is executed.

If the music contents C or the contents key Kc are destroyed; thecomprehensive management unit (X)315 first accesses the EMD server(X)4-3 to perform user authentication.

The EMD server (X)4-3 then refers to the use log information of thecomprehensive management unit (X)315, from the user ID of the authorizeduser, to generate an integrity check value (ICV). This ICV is generated,based on the CID, as the contents ID of the music contents C stated inthe use log information and on the storage key KS of the comprehensivemanagement unit (X)315, in accordance with:

ICV=H(SK, CIDI||CID 2 ||, . . . ||CIDn)

where H(K, Data) is a uni-directional hash function and has its valuechanged with the key K.

The EMD server (X)4-3 then transmits the generated integrity check valueICV to the comprehensive management unit (X)315.

If the music contents C or the contents key Kc are backed up, thecomprehensive management unit (X)315 re-stores the backup data to savethe music contents C or the contents key Kc in the hard disc 21. If themusic contents C or the contents key Kc are backed up, the musiccontents C or the contents key Kc destructed is to be re-distributedfrom the EMD server (X)4-3. At this time, the EMD server (X)4-3references to the purchase hysteresis of the user, and refrains fromassessment if the contents have once been purchased.

The comprehensive management unit (X)315 performs the above processingto re-construct the music contents C or the contents key Kc destroyed.

If the music contents C or the contents key Kc regenerated are to bereproduced or controlled, the comprehensive management unit (X)315checks the CID of the music contents by the integrity check value ICV.By checking the music contents C or the contents key Kc reconstructedusing the integrity check value ICV, a user with a malignant intention,who memorized E (Kci, Ci) as encrypted music contents Ci and re-storedthe music contents, in case the music contents Ci is moved to theportable device (X)6-3 and is erased from the hard disc 21, is unable toreproduce or move the data by way of control.

If it is not the music contents C or the contents key Kc but the storagekey KS that has been destroyed, the comprehensive management unit (X)315is re-installed. Even in such case, re-storage or re-downloading isfeasible if user registration is made in the EMD server (X)4-3 and thelog information is uploaded.

In the music contents distributing system 1, as described above, musiccontents can be re-constructed, under protection of the copyright, evenif the music contents have been destroyed by hard disc crushing. If, forexample, the music contents have been purchased correctly, it can bere-constructed free of charge.

(5) Method for Allotting Master Key and Authentication Key of theComprehensive Management Unit (X)

Between the comprehensive management unit (X)315 and the portable device(X)6-3, there occurs reciprocal authentication using the ID and anauthentication key (MG-ID/IK) proper to the portable device (X)6-3 and amaster key (OMG-MK) proper to the comprehensive management unit (X)315.

If there has occurred reciprocal authentication between thecomprehensive management unit (X)315 and the portable device (X)6-3, itbecomes possible for the comprehensive management unit (X)315 to sendmusic contents from the comprehensive management unit (X)315 to theportable device (X)6-3 or to return the music contents from the portabledevice (X)6-3 to the comprehensive management unit (X)315. Meanwhile,the comprehensive management unit (X)315 holds the encrypted musiccontents in the hard disc 21 of the perspective view 3, whilst theportable device (X)63 holds the encrypted music contents in the internalrecording medium, such as a memory card. So, if the music contents aresent from the comprehensive management unit (X)315 to the portabledevice (X)6-3, music contents on the hard disc 21 on the personalcomputer 1 are transferred to the memory card loaded on the portabledevice 10. On the other hand, if music contents are to be sent from theportable device (X)6-3 to the comprehensive management unit (X)315, themusic contents on the memory card loaded on the portable device (X)6-3are transferred to the hard disc 21 on the personal computer 1.

The portable device (X)6-3 holds ID information (MG-ID), authenticationkeys (MG-IK) for plural generations and master keys (OMG-MK) for pluralgenerations from the outset. The portable device (X)6-3 is not furnishedwith these keys or the information from outside. The portable device(X)6-3 updates the generation of the authentication keys (MG-IK) and themaster keys (OMG-MK). The portable device (X)6-3 effectuates reciprocalauthentication not by the authentication key or master key of the oldgeneration, but by those of the new generation. In the following it isassumed that the portable device (X)6-3 is holding the authenticationkeys (MG-ID) and the master keys (OMG-MK) for 100 generations of fromzeroth to 100th generations. The authentication key for the ithgeneration is denoted the (MG-IK[i]) and the master key for the ithgeneration is denoted the (OMG-MK[i]).

The comprehensive management unit (X)315, holding the master keys(OMG-MK), is able to transfer the music contents from e.g., a compactdisc for audio into the personal computer 1 for storage therein. On theother hand, the comprehensive management unit (X)315, holding the masterkeys (OMG-MK), is able to download the music contents from the EMDserver (X)4-3 for storage in the personal computer 1.

It is noted that, in the comprehensive management unit (X)315, themaster key (OMG-MK), that is able to transfer the music contents fromthe compact disc but is unable to download music contents from the EMDserver (X)4-3, differs from the master key (OMG-MK), that is able totransfer music contents both from the CD and from the EMD server (X)4-3.In the following, the key that is able to transfer the music contentsfrom the compact disc but is unable to download music contents from theEMD server (X)4-3 is termed a key dedicated to ripping and the key thatis able to transfer music contents both from the CD and the EMD server(X)4-3 is termed an EMD key.

In the present embodiment, the master key for the zeroth generation(OMG-MK[0]) is the key dedicated to ripping, whilst the master keys(OMG-MK[1 to 99]) are EMD keys.

The sequence for processing employing the key dedicated to ripping isexplained.

If the comprehensive management unit (X)315 is to be installed from theCD-ROM, the portable device (X)6-3 and a floppy disc 52, for example,are sold as a set with a CD-ROM 51 having installed therein aninstalling software of the comprehensive management unit (X)315, asshown in FIG. 27. In the floppy disc 52 are stored the ID information(MG-ID) for the portable device (X)6-3, the authentication key for thezeroth generation (MG-IK[0]) and the master key for the zerothgeneration (OMG-MK[0]).

For enabling the sold portable device (X)6-3 etc., to be used, theCD-ROM 361 is first loaded on the personal computer 1 (step S11). Thecomprehensive management unit (X)315 then is installed from the CD-ROM361 onto the personal computer 1. The comprehensive management unit(X)315 then is installed in the hard disc of the personal computer 1(step S13). The ID information (MG-ID) of the portable device (X)6-3,stored in the floppy disc 362, the authentication key for the zerothgeneration (MG-IK[0]) and the master key for the zeroth generation(OMG-MK[0]) are then saved in the personal computer 1 (step S14).

This enables the music contents furnished by e.g., a music CD 363 to bestored in the hard disc of the personal computer 1 (step S15).Meanwhile, since the master key for the zeroth generation (OMG-MK[0]) isa key dedicated to ripping, no music contents can be downloaded from theEMD server (X)4-3.

The portable device (X)6-3 holds authentication keys and master keys for100 generations to cope with generation updating. In the initialsetting, the generation is the zeroth generation. So, reciprocalauthentication between the comprehensive management unit (X)315 holdingthe authentication key of the zeroth generation and the master key andthe portable device (X)6-3 becomes feasible. Thus, it becomes possibleto store the music contents furnished by the music CD 363 etc in thememory card of the portable device (X)6-3 (step S16).

On the other hand, if the comprehensive management unit (X)315 isfurnished through the network, the address, user ID and the passwordetc., on the EMD registration server 3 on the Internet, along with thecomprehensive management unit (X)315, as shown in FIG. 28.

If the portable device (X)6-3 etc., as sold, is to be rendered usable,the EMD registration server 3 on the network is accessed, using the userID and the password (step S21). The EMD registration server 3 thenauthenticates the user ID and the password (step S22). If there is noproblem in the authentication, the EMD registration server 3 transmitsthe installing software of the comprehensive management unit (X)315, IDinformation (MG-ID) of the portable device (X)6-3, the authenticationkey of the zeroth generation (MG-IK[0]) and the master key of the zerothgeneration (OMG-MK[0]) to the personal computer 1 (step S23). Thepersonal computer 1 then boots the installing software of thecomprehensive management unit (X)315 to install the comprehensivemanagement unit (X)315, while saving the ID information (MG-ID) of theportable device (X)6-3, the authentication key of the zeroth generation(MG-IK[0]) and the master key of the zeroth generation (OMG-MK[0]) inthe hard disc 21 (step S24). This stores the comprehensive managementunit (X)315 in the hard disc (step S25).

This enables the comprehensive management unit (X)315, furnished bye.g., the music CD 363, to be stored in the hard disc 21 of the personalcomputer 1 (step S26). Meanwhile, since the master key of the zerothgeneration (OMG-MK[0]) is a key dedicated to ripping, the music contentscannot be downloaded from the EMD server (X)4-3.

The portable device (X)6-3 holds the authentication keys and master keysfor 100 generations, in order to cope with the generation innovation. Inthe initial state, the generation is set to the zeroth generation. So,the reciprocal authentication between the comprehensive management unit(X)315 holding the authentication key and the master key of the zerothgeneration and the portable device (X)6-3 becomes possible. Therefore,the music contents furnished by the music CD 363 etc., can be stored inthe memory card of the portable device (X)6-3.

In addition to the method shown in FIGS. 27 and 28, such a method mayalso be used in which the comprehensive management unit (X)315 and themaster key of the zeroth generation (OMG-MK[0]) dedicated to ripping isstored in the CD-ROM 361 and in which the authentication ID with respectto the portable device (X)6-3 and the authentication key for the zerothgeneration (MG-ID/IK) are furnished over the network.

The sequence of operations for updating the key dedicated to ripping toan EMD key to enable the handling of music contents downloaded from theEMD server (X)4-3 is hereinafter explained.

The comprehensive management unit (X)315 is furnished via a removablemedium, such as a CD-ROM, or over a network, such as Internet, by thesequence of operations shown in FIGS. 27 and 28, and is installed in thehard disc 21 in the personal computer 1. At this time, the comprehensivemanagement unit (X)315 is holding the master key of the zerothgeneration (OMG-MK[0]) dedicated to ripping and the authentication keyfor the zeroth generation (MG-ID/IK[0]), with the key of the portabledevice (X)6-3 being in the default generation.

First, the personal computer 1 accesses th EMD registration server 3 onthe network, using the user ID and the password (step S31), as shown inFIG. 29. The EMD registration server 3 then authenticates the user IDand the password (step S32). If there is no problem in authentication,the EMD registration server 3 registers the ID information of thepersonal computer 1 (OMG-ID) to generate an open key (OMG-PK), secretkey (OMG-SK) and the writ of authentication (Cert [PK]) of the open keyfor the comprehensive management unit (X)315 to connect to the EMDserver (X)4-3 (step S33). The EMD registration server 3 then transmitsthe generated open key (OMG-PK), secret key (OMG-SK) and the writ ofauthentication (Cert [PK]) to the personal computer 1 (step S34).

The EMD registration server 3 then transmits the ID information of theportable device (X)6-3 (MG-ID), authentication key of the ith generation(MG-IK[i]) and the master key of the ith generation (OMG-MK[i]) to thepersonal computer 1 (step S35). The EMD registration server 3 thenupdates the received keys etc., based on the received ID information(MG-ID), authentication key of the ith generation (MG-IK[i]) and themaster key of the ith generation (OMG-MK[i]) to the ith generation (stepS36). The comprehensive management unit (X)315 then executesauthentication with the portable device (X)6-3 (step S37). Onauthentication the portable device (X)6-3 updates the generation of theown key to the ith generation (step S38).

This enables the comprehensive management unit (X)315 to store musiccontents furnished by the music CD 363 to be stored in the hard disc ofthe personal computer 1 as well as to store the music contentsdownloaded from the EMD server (X)4-3 in the hard disc 21 of thepersonal computer 1 (step S39).

The sequence of operations of generation innovation of e.g., the EMD keyis explained.

The comprehensive management unit (X)315 is holding the master key ofthe ith generation (OMG-MK[i]), ID for au and the authentication key ofthe zeroth generation (MG-IK[i]), with the generation of the portabledevice (X)6-3 being also the ith generation.

First, as shown in FIG. 30, if the personal computer 1 accesses the EMDregistration server 3 to do some processing, the EMD registration server3 authenticates the ID of the comprehensive management unit (X)315 totransmit the authentication key of the (i+k)th generation (MG-IK[i+k])and the master key of the (i+k)th generation (OMG-MK[i+k]) to thepersonal computer 1 (step S41). The comprehensive management unit (X)315of the personal computer 1 updates the received authentication key andthe master hey to the (i+k)th generation (step S42). The comprehensivemanagement unit (X)315 then authenticates the portable device (X)6-3(step S43). When authenticated, the portable device (X)6-3 updates thegeneration of the own key from the ith generation to the (i+k)thgeneration (step S44).

On the other hand, as shown in FIG. 31, if the generation of theauthentication key etc., used by the portable device (X)6-3, is the(i+k)th generation, and that of the authentication key etc., held by thecomprehensive management unit (X)315 is the ith generation, theauthentication between the portable device (X)6-3 and comprehensivemanagement unit (X)315 results in failure, even if such authenticationis attempted, (Step S51). If the authentication results in failure, thecomprehensive management unit (X)315 requests a key to the EMDregistration server 3 (step S52). If there is a key request, the EMDregistration server 3 authenticates the ID of the comprehensivemanagement unit (X)315 to transmit the authentication key of the (i+k)thgeneration (MG-IK[i+k]) and the master key of the (i+k)th generation(OMG-MK[i+k]) (step S53). The comprehensive management unit (X)315 thenupdates the received authentication key and master key to the (i+k)thgeneration (step S54). The comprehensive management unit (X)315 thenauthenticates the portable device (X)6-3 (step S55).

This enables the comprehensive management unit (X)315 to store the musiccontents furnished by the music CD 363 etc., to be stored in the harddisc 21 in the personal computer 1 and to store the music contentsdownloaded from the EMD server (X)4-3 to be stored in the hard disc 21in the personal computer 1 (step S38).

In the above-described music contents distributing system 1, the masterand authentication keys, used by the comprehensive management unit(X)315 and the portable device (X)6-3, are classed into keys dedicatedto ripping and those connected to the server, and the keys connected tothe server are downloaded over the network. The result is that, in themusic contents distributing system 1, safety in the music contentsdistributed from the server is improved, such that, if the keysdedicated to ripping are broken, the music contents downloaded from theserver cannot be destroyed.

In the music contents distributing system 1, the master andauthentication keys, used by the comprehensive management unit (X)315and the portable device (X)6-3, are used subject to generationinnovation. Moreover, the comprehensive management unit (X)315 is fedwith the master and authentication keys over the network for generationinnovation, thus raising safety of the music contents.

INDUSTRIAL APPLICABILITY

According to the present invention, a data processing apparatusreproduces and/or controls restored or re-distributed backup contentsdata, based on the using log information re-acquired from a contentsserver.

Thus, according to the present invention, even if the contents data,distributed over the network, is once destroyed, the contents data canbe restored as the copyright protection is assured.

What is claimed is:
 1. A contents furnishing system comprising: acontents server for distributing contents data over a network; and adata processor having a reproduction control program for reproducingand/or controlling contents data, said data processor storing thecontents data distributed from said contents server on a recordingmedium for reproduction and/or control, and storing backup data of thedistributed contents data on a recording medium, said data processoralso transmitting the using log information of said contents data tosaid contents server; said data processor acquiring said using loginformation from said contents server if the contents data cease to beavailable from said recording medium, said data processor performingreproduction and/or control of the backup data of the contents datastored in said recording medium depending on said using log information.2. A method for distributing contents between a data processor having areproduction control program for reproducing and/or controlling contentsdata and a contents server for distributing the contents data through anetwork to said data processor, said method comprising the steps of:said contents server distributing contents data to said data processor;said data processor memorizing the contents data distributed from saidcontents server in a recording medium for reproduction and/or controland also memorizing backup data of the distributed contents data in arecording medium; said data processor transmitting the using loginformation of said contents data to said contents server; said contentsserver transmitting said using log information to said data processor ifsaid data processor is unable to acquire said contents data from saidrecording medium; and said data processor reproducing and/or controllingthe backup data of the contents data stored in said recording mediumresponsive to said using log information.
 3. A computer readable mediumadapted for being installed in a data processor and having storedtherein a reproduction control program for acquiring contents datadistributed over a network from a contents server for reproducing and/orcontrolling the contents data; said reproduction control programcomprising: memorizing the contents data distributed from said contentsserver in a recording medium for reproduction and/or control andmemorizing backup data of the distributed contents data, andtransmitting the using log information of said contents data to saidcontents server; and acquiring said using log information from saidcontents server if the contents data cease to be available from saidrecording medium and reproducing and/or controlling backup data ofcontents data stored in said recording medium in keeping with said usinglog information.
 4. An information processing apparatus comprising: aplayback control program for reproducing and/or controlling contentsdata distributed from a contents server over a network; and a dataprocessing device for storing the contents data distributed from saidcontents server for reproducing and/or controlling the contents data,said data processing device storing backup data of the distributedcontents data in said recording medium or another recording medium andtransmitting the use log information of said contents data to saidcontents server; said data processing device when unable to acquirecontents data from said recording medium acquiring data derived fromsaid use log information from said contents server to reproduce and/orcontrol said backup data stored in said recording medium or said otherrecording medium.
 5. The information processing apparatus according toclaim 4 wherein said use log information includes an ID of contentsstored in said recording medium and the purchasing recording informationof contents distributed from said contents server.
 6. The informationprocessing apparatus according to claim 4 wherein said contents dataincludes contents and a contents key; said data processing deviceacquiring an ICV (integrity check value), derived from said use loginformation, from said contents server, when the contents and/or thecontents key stored in said recording medium is destroyed, to reproduceand/or control said backup data stored in said recording medium or insaid other recording medium.
 7. An information processing method forreproducing and/or controlling contents data distributed from a contentsserver over a network, comprising: storing the contents data distributedfrom said contents server for reproduction and/or controlling, storingbackup data of the distributed contents data in said recording medium oranother recording medium and transmitting the use log information ofsaid contents data to said contents server; acquiring data derived fromsaid use log information from said contents server to reproduce and/orcontrol said backup data stored in said recording medium or said otherrecording medium when contents data cease to be acquired from saidrecording medium.
 8. The information processing method according toclaim 7 wherein said use log information includes an ID of contentsstored in said recording medium and the purchasing recording informationof contents distributed from said contents server.
 9. The informationprocessing method according to claim 7 wherein said contents dataincludes contents and a contents key, and wherein an ICV (integritycheck value), derived from said use log information, is acquired fromsaid contents server, when the contents and/or the contents key storedin said recording medium are destroyed, to reproduce and/or control saidbackup data stored in said recording medium or in said other recordingmedium.
 10. A contents distributing method for distributing contentsdata over a network to an information processing apparatus forreproduction and/or control, comprising: distributing contents data tosaid information processing apparatus; receiving the use log informationof the distributed contents data from said information processingapparatus and storing the received use log information; accessing fromsaid information processing apparatus being made when the contents datacease to be acquired from a recording medium in said informationprocessing apparatus; and transmitting data derived from said use loginformation to said information processing apparatus responsive to saidaccessing to cause said information processing apparatus to performreproduction and/or control of backup data of said contents data storedin said recording medium or said other recording medium in saidinformation processing apparatus responsive to said data derived fromsaid use log information.
 11. The information processing methodaccording to claim 10 wherein said use log information includes an ID ofcontents stored in said recording medium in said information processingapparatus and the purchasing recording information of contentsdistributed to said information processing apparatus; when saidaccessing is made, it is verified, based on said purchasing recordinginformation, whether or not the contents data that cease to be acquiredis the contents already purchased by the user; and wherein if it isverified that the contents data that cease to be acquired is thecontents data already purchased by the user who made the accessing, thecontents data that cease to be acquired are not assessed.
 12. Theinformation processing method according to claim 10 wherein saidcontents data include contents and/or a contents key; if the contentsand/or the contents key stored in said recording medium in saidinformation processing apparatus are destroyed, access is made from saidinformation processing apparatus; and wherein an ICV (integrity checkvalue) derived from said use log information is transmitted inassociation with said accessing to said information processingapparatus.